To Next Page

To Previous Page

181

[RouterB-ipsec-policy-manual-use1-10] sa spi inbound esp 12345

# Configure the keys.

[RouterB-ipsec-policy-manual-use1-10] sa string-key outbound esp gfedcba

[RouterB-ipsec-policy-manual-use1-10] sa string-key inbound esp abcdefg

[RouterB-ipsec-policy-manual-use1-10] quit

# Configure the IP address of the serial interface.

[RouterB] interface serial 2/2

[RouterB-Serial2/2] ip address 2.2.3.1 255.255.255.0

# Apply the IPsec policy group to the interface.

[RouterB-Serial2/2] ipsec policy use1

3. Verify the configuration:

After the configuration, an IPsec tunnel between Router A and Router B should be established,

and the traffic between subnet 10.1.1.0/24 and subnet 10.1.2.0/24 should be IPsec protected.

Configuring IKE-based IPsec tunnel

Network requirements

As shown in Figure 58, configure an IPsec tunnel between Router A and Router B to protect data

flows between subnet 10.1.1.0/24 and subnet 10.1.2.0/24. Configure the tunnel to use the security

protocol ESP, the encryption algorithm DES, and the authentication algorithm SHA1-HMAC-96.

Configuration procedure

1. Configure Router A:

# Define an ACL to identify data flows from subnet 10.1.1.0/24 to subnet 10.1.2.0/24.

<RouterA> system-view

[RouterA] acl number 3101

[RouterA-acl-adv-3101] rule permit ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0

0.0.0.255

[RouterA-acl-adv-3101] quit

# Configure a static route to Host B.

[RouterA] ip route-static 10.1.2.0 255.255.255.0 serial 2/1

# Create an IPsec transform set named tran1.

[RouterA] ipsec transform-set tran1

# Specify the encapsulation mode as tunnel.

[RouterA-ipsec-transform-set-tran1] encapsulation-mode tunnel

# Specify the security protocol as ESP.

[RouterA-ipsec-transform-set-tran1] transform esp

# Specify the algorithms for the IPsec transform set.

[RouterA-ipsec-transform-set-tran1] esp encryption-algorithm des

[RouterA-ipsec-transform-set-tran1] esp authentication-algorithm sha1

[RouterA-ipsec-transform-set-tran1] quit

# Configure the IKE peer.

[RouterA] ike peer peer

[RouterA-ike-peer-peer] pre-shared-key abcde

[RouterA-ike-peer-peer] remote-address 2.2.3.1

[RouterA-ike-peer-peer] quit

# Create an IPsec policy that uses IKE for IPsec SA negotiation.

[RouterA] ipsec policy map1 10 isakmp

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English

HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

Table of Contents

Other manuals for HPE FlexNetwork MSR Series

Questions and Answers:

HPE FlexNetwork MSR Series Specifications

Related product manuals